OpenAI Agent SDK

• Analyzed: May 15, 2026, 7:30 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5cee8208a8a6d4b1b1a975ea626f84d8ac58d1e8c0b1f469554004338dbf0328
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a critical Remote Code Execution (RCE) vulnerability in 'examples/tools_example.py' and 'SKILL.md'. The 'calculate' tool uses the Python 'eval()' function to process user-provided strings without any sanitization, which allows for arbitrary code execution. While this appears to be a poorly implemented example rather than intentional malware, the inclusion of such a dangerous pattern in a 'Best Practices' section is highly risky.